Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts
Nitesh Dhanjani's 2015 O'Reilly book Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts is a very practical existence-proof of the inadequacy and urgency of Internet of Things security.
The usual O'Reilly book is a kind of cook-book for accomplishing normal technical tasks, each recipe serving to illustrate broader technical principles. Millions of skilled technical people have followed the steps in O'Reilly books to master Perl and Ruby and Python, become master network administrators, or just master shell scripting.
Abusing the Internet of Things is structured just like one of those cookbooks, only the recipes explain the (relatively simple) steps you need take to compromise everything from a smart lightbulb -- one recipe explains how to plunge a smart lighting system into permanent, irrevocable darkness -- to a smart baby-monitor (this was published months before a family in San Francisco woke to discover a griefer terrorizing their toddler through his bedside monitor) to a smart TV to -- what else? -- a smart car.
In so doing, Dhanjani -- who has presented widely on the subject, including an excellent talk at Black Hat Asia -- illustrates the utter shoddiness of IoT security, and incontrovertibly illustrates the risks from bad information security when every corner of our homes is infiltrated by computers.
But this isn't just a cautionary tale. After walking the reader through a series of examples, complete with source-code and exercises for the student, Dhanjani flips the script, and uses all he's discussed to build a secure, smart doorbell that's connected to the public Internet, with security in it by design. The distance between the approach in this exercise and the approaches taken by the vendors Dhanjani outs as security bumblers is the clincher, the proof that the things you buy are broken because no one cared enough about them to make them hard to break.
Two final chapters sum up the scenarios for future IoT attacks, and dramatize the institutional processes that produce such poor quality devices for our consumption.
The book is written in a spritely, writerly fashion, with many grace notes and interesting case studies -- including an account of how you could use someone's hacked email account to steal their Tesla automobile.
This book is a marvellous thing: an important intervention in the policy debate about information security and a practical text for people trying to improve the situation.
Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts [Nitesh Dhanjani/O'Reilly]
(Image: "Activate the world" (or: what "mobile" really means), Mike, CC-BY)
Psych scholars from San Diego State and U Georgia used Google Books to systematically explore the growth of swear-words in published American literature: they conclude that books are getting swearier and that this is a bellwether for a growth in the value of individualism: “Due to the greater valuation of the rights of the individual […]
Back in 2011, The New York Review of Books inducted Daniel Pinkwater’s classic Lizard Music into its canon with a handsome little hardcover edition; today they follow that up with a stylish, jazzy paperback, priced to move at $10.
After years of buzz, the USC Game Innovation Lab finally released Walden: The Game earlier this month, allowing players to immerse themselves in a six-hour experience in which they play Henry David Thoreau on his gripping quest for solitude and mental clarity.
The Pry.Me Bottle Opener holds tens of thousands of times its own weight, and you can pick one up now from the Boing Boing Store.This remarkable keychain is considerably smaller than any of your keys, but don’t let that fool you: it can easily open any bottle, and could even tow a trailer full of […]
Guaranteeing your privacy online goes way beyond checking the “Do Not Track” option in your browser’s settings. To ensure that your internet activity is totally hidden from Internet Service Providers, advertisers, and other prying eyes, take a look at Windscribe’s VPN protection. It usually costs $7.50 per month, but you can get a 3-year subscription […]
This project management bundle will help you get organized and learn how to lead a team to success. You can pay what you want for these five courses when you pick them up from the Boing Boing Store.To help you become an invaluable asset for your company, this bundle includes a curated collection of professional […]